CVE-2020-15234: Redirect URL matching ignores character casing in github.com/ory/fosite
Summary
CVE-2020-15234: Redirect URL matching ignores character casing. Affects github.com/ory/fosite versions < 0.34.1. Fixed in 0.34.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/ory/fosite is a Go library for implementing OAuth2 and OpenID Connect servers and clients. It provides functionality for handling authentication and authorization in web applications. This vulnerability affects versions before v0.34.1 of the package.
Vulnerability Detail
The vulnerability in github.com/ory/fosite arises from the incorrect comparison of registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint. Instead of performing a simple string match, the comparison is done using strings.ToLower, which ignores character casing. This allows an attacker to bypass the intended redirect URL validation by providing a redirect URL with different casing. For example, if a client is registered with the allowed redirect URL https://example.com/callback, an attacker can request the redirect URL https://example.com/CALLBACK and still be redirected to it with a potentially successful OAuth2 response.
How To Fix
Latest published version: v0.49.0 as of 23 Oct 2026
go get github.com/ory/fosite@v0.49.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.34.1
This is the first release that contains the fix.
go get github.com/ory/fosite@v0.34.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of github.com/ory/fosite as soon as possible.
Conclusion
In conclusion, the vulnerability in github.com/ory/fosite allows an attacker to bypass redirect URL validation in OAuth2 flows. To mitigate this vulnerability, it is crucial to update to version v0.34.1 or later of the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/ory/fosite →
FAQ
github.com/ory/fosite is a Go library for implementing OAuth2 and OpenID Connect servers and clients. It provides functionality for handling authentication and authorization in web applications.
The vulnerability allows an attacker to bypass redirect URL validation in OAuth2 flows, potentially leading to unauthorized access or other security issues.
To fix this vulnerability, update your implementation of github.com/ory/fosite to version v0.34.1 or later.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of github.com/ory/fosite.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-grfp-q2mm-hfp6.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/fosite.
